Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a very clean brand new install of CentOS 5.3 running on a vps hosted by linode. After installing the new OS, I did a yum update to apply recent patches. I then did yum install sudo to install sudo (I was surprised it was not installed by default). I edited the sudoers file, and all went well. I log in via ssh as a regular user and use sudo whenever I need to do something that requires root privileges, I think that this is a good practice because it makes me aware that I should be a bit extra cautious when issuing these commands. The problem is whenever I issue a sudo command I get an error message:

audit_log_user_command(): Connection refused

the command is executed, but no record of the command is logged as evidenced by:

grep sudo /var/log/messages

returns only one line referencing the yum install.

share|improve this question
up vote 0 down vote accepted

The error mentioned is due to the fact that CentOS by default doesn't have auditd compiled in to the kernel. The error is purely a cosmetic fault and can be safely ignored.

I think that one can get rid of the error by compiling a new kernel (> 2.6.23) and enable auditd support by selecting 'CONFIG_AUDIT=y'. Also, updating to a newer version of sudo might do the trick, but as I don't have access to any CentOS machines, YMMV.

share|improve this answer

On CentOS you should check /var/log/secure not /var/log/messages and ensure that auditd it's started:

# start auditd
/etc/init.d/auditd start

# configure to start on boot
/sbin/chkconfig --level 2345 auditd on
share|improve this answer

This won't fix this problem, but you should use

su -

I find it less annoying than typing sudo in front of every command, and it should get logged.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.